GitLab Patches Maximum-Severity Flaw That Reaches Back to 2014 Releases

GitLab released fixes on October 21 for a critical flaw, tracked as CVE-2026-110264, that could let an attacker run code on a self-managed server without logging in. It is rated 10.0 on the CVSS scale, the maximum, and affects every version going back to 7.0, released in 2014. GitLab says that, under certain conditions, the problem could be triggered by an integer overflow during the compilation of a specially crafted regular expression. The company has not said what those conditions are.

Administrators who patched on October 12 should check again. That update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an updated instance can be back in range. GitLab fixed the flaw in seven versions at once, including four older releases (18.11.13, 19.0.10, 19.1.9 and 19.2.9), a backport step it reserves for severe issues. The flaw reaches so far back because it sits in Onigmo, Ruby's built-in regular-expression engine, which GitLab ships inside its own packages. Only self-managed installations need to act. GitLab.com already runs the fixed version, as do GitLab Dedicated tenants on the stated internal releases or later.

GitLab reports no sign of attacks, and the flaw was not in the U.S. CISA known exploited vulnerabilities catalog as of October 22. It has also published two detection rules, "Onigmo native worker crash" and "Org mode render error burst", to help administrators look for exploitation attempts in their application logs.